File name:

03782294

Full analysis: https://app.any.run/tasks/ceda871a-efad-4033-9888-debecbdf5b74
Verdict: Malicious activity
Threats:

Crypto mining malware is a resource-intensive threat that infiltrates computers with the purpose of mining cryptocurrencies. This type of threat can be deployed either on an infected machine or a compromised website. In both cases the miner will utilize the computing power of the device and its network bandwidth.

Malware Trends Tracker     >>>
Analysis date: August 03, 2024, 19:52:44
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
installer
stealer
netreactor
miner
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

609FEA742D34DC1D53F0EEB4873B1A0A

SHA1:

3232C52DA3CB8F47A870162A35CDD75FCAE60AEA

SHA256:

E2E15826B69778E381F25AC8F2B109A377B23F7CF79B5F482E81F4D28C30F95E

SSDEEP:

98304:wSiW4opH4opH4op4U9tNz9RGa/xlbLP/h4:ZDBDBD1t3Hbb+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 03782294.exe (PID: 6412)
      • 03782294.exe (PID: 6504)
      • 03782294.tmp (PID: 6528)
      • CheatEngine75.exe (PID: 4924)
      • prod0.exe (PID: 7164)
      • 4rxjtkoi.exe (PID: 6272)
      • CheatEngine75.tmp (PID: 2632)
      • UnifiedStub-installer.exe (PID: 4576)

    • Starts NET.EXE for service management

      • CheatEngine75.tmp (PID: 2632)
      • net.exe (PID: 5032)
      • net.exe (PID: 5512)

    • Actions looks like stealing of personal data

      • UnifiedStub-installer.exe (PID: 4576)
      • rsEngineSvc.exe (PID: 6420)

    • Changes the autorun value in the registry

      • rundll32.exe (PID: 5064)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • 03782294.tmp (PID: 6432)
      • 03782294.tmp (PID: 6528)
      • prod0.exe (PID: 7164)
      • Cheat Engine.exe (PID: 6176)
      • rsEDRSvc.exe (PID: 1372)
      • rsEngineSvc.exe (PID: 6420)

    • Reads security settings of Internet Explorer

      • 03782294.tmp (PID: 6432)
      • 03782294.tmp (PID: 6528)
      • prod0.exe (PID: 7164)
      • Cheat Engine.exe (PID: 6176)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5904)
      • rsWSC.exe (PID: 3876)
      • rsEngineSvc.exe (PID: 4784)
      • rsEDRSvc.exe (PID: 6256)
      • UnifiedStub-installer.exe (PID: 4576)
      • rsEngineSvc.exe (PID: 6420)

    • Executable content was dropped or overwritten

      • 03782294.exe (PID: 6412)
      • 03782294.tmp (PID: 6528)
      • CheatEngine75.exe (PID: 4924)
      • CheatEngine75.tmp (PID: 2632)
      • 03782294.exe (PID: 6504)
      • 4rxjtkoi.exe (PID: 6272)
      • UnifiedStub-installer.exe (PID: 4576)
      • prod0.exe (PID: 7164)

    • Reads the Windows owner or organization settings

      • 03782294.tmp (PID: 6528)
      • CheatEngine75.tmp (PID: 2632)

    • Starts SC.EXE for service management

      • CheatEngine75.tmp (PID: 2632)

    • Uses ICACLS.EXE to modify access control lists

      • CheatEngine75.tmp (PID: 2632)

    • Process drops legitimate windows executable

      • 4rxjtkoi.exe (PID: 6272)
      • CheatEngine75.tmp (PID: 2632)
      • UnifiedStub-installer.exe (PID: 4576)

    • Creates a software uninstall entry

      • UnifiedStub-installer.exe (PID: 4576)

    • Process drops SQLite DLL files

      • CheatEngine75.tmp (PID: 2632)

    • Searches for installed software

      • UnifiedStub-installer.exe (PID: 4576)

    • Executes as Windows Service

      • rsSyncSvc.exe (PID: 3908)
      • rsClientSvc.exe (PID: 6908)
      • rsEngineSvc.exe (PID: 6420)
      • rsEDRSvc.exe (PID: 1372)
      • WmiApSrv.exe (PID: 3552)
      • rsWSC.exe (PID: 7080)

    • Checks Windows Trust Settings

      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5904)
      • UnifiedStub-installer.exe (PID: 4576)
      • rsWSC.exe (PID: 3876)
      • rsEngineSvc.exe (PID: 4784)
      • rsWSC.exe (PID: 7080)
      • rsEDRSvc.exe (PID: 6256)
      • rsEDRSvc.exe (PID: 1372)

    • The process drops C-runtime libraries

      • UnifiedStub-installer.exe (PID: 4576)

    • Adds/modifies Windows certificates

      • UnifiedStub-installer.exe (PID: 4576)
      • rsWSC.exe (PID: 3876)
      • rsEDRSvc.exe (PID: 1372)

    • Creates or modifies Windows services

      • rundll32.exe (PID: 5064)
      • UnifiedStub-installer.exe (PID: 4576)

    • Uses RUNDLL32.EXE to load library

      • UnifiedStub-installer.exe (PID: 4576)

    • Creates files in the driver directory

      • UnifiedStub-installer.exe (PID: 4576)

    • The process creates files with name similar to system file names

      • UnifiedStub-installer.exe (PID: 4576)

    • Drops a system driver (possible attempt to evade defenses)

      • UnifiedStub-installer.exe (PID: 4576)

    • Uses WEVTUTIL.EXE to install publishers and event logs from the manifest

      • UnifiedStub-installer.exe (PID: 4576)

    • Detected use of alternative data streams (AltDS)

      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5904)

    • There is functionality for communication over UDP network (YARA)

      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5904)

    • Reads the BIOS version

      • rsEDRSvc.exe (PID: 1372)
      • rsEngineSvc.exe (PID: 6420)

    • Dropped object may contain URLs of mainers pools

      • rsEngineSvc.exe (PID: 6420)

    • Drops 7-zip archiver for unpacking

      • UnifiedStub-installer.exe (PID: 4576)

    • Application launched itself

      • rsAppUI.exe (PID: 3996)

    • The process checks if it is being run in the virtual environment

      • rsEngineSvc.exe (PID: 6420)

    • Process checks is Powershell's Script Block Logging on

      • rsEDRSvc.exe (PID: 1372)

  • INFO

    • Create files in a temporary directory

      • 03782294.exe (PID: 6412)
      • 03782294.exe (PID: 6504)
      • 03782294.tmp (PID: 6528)
      • CheatEngine75.exe (PID: 4924)
      • CheatEngine75.tmp (PID: 2632)
      • prod0.exe (PID: 7164)
      • 4rxjtkoi.exe (PID: 6272)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5904)
      • UnifiedStub-installer.exe (PID: 4576)
      • rsAppUI.exe (PID: 3996)

    • Checks supported languages

      • 03782294.exe (PID: 6412)
      • 03782294.tmp (PID: 6432)
      • 03782294.exe (PID: 6504)
      • 03782294.tmp (PID: 6528)
      • prod0.exe (PID: 7164)
      • CheatEngine75.exe (PID: 4924)
      • CheatEngine75.tmp (PID: 2632)
      • _setup64.tmp (PID: 6236)
      • 4rxjtkoi.exe (PID: 6272)
      • UnifiedStub-installer.exe (PID: 4576)
      • rsSyncSvc.exe (PID: 6324)
      • rsSyncSvc.exe (PID: 3908)
      • Kernelmoduleunloader.exe (PID: 5656)
      • windowsrepair.exe (PID: 1432)
      • Cheat Engine.exe (PID: 6176)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5904)
      • rsWSC.exe (PID: 3876)
      • rsWSC.exe (PID: 7080)
      • rsClientSvc.exe (PID: 7040)
      • rsEngineSvc.exe (PID: 4784)
      • rsEngineSvc.exe (PID: 6420)
      • rsHelper.exe (PID: 6688)
      • rsEDRSvc.exe (PID: 6256)
      • rsEDRSvc.exe (PID: 1372)
      • EPP.exe (PID: 1128)
      • rsAppUI.exe (PID: 3996)
      • rsAppUI.exe (PID: 3988)
      • rsAppUI.exe (PID: 1692)
      • rsAppUI.exe (PID: 1784)
      • rsLitmus.A.exe (PID: 7192)
      • rsAppUI.exe (PID: 7288)
      • rsClientSvc.exe (PID: 6908)

    • Reads the computer name

      • 03782294.tmp (PID: 6432)
      • 03782294.tmp (PID: 6528)
      • prod0.exe (PID: 7164)
      • CheatEngine75.tmp (PID: 2632)
      • UnifiedStub-installer.exe (PID: 4576)
      • rsSyncSvc.exe (PID: 6324)
      • rsSyncSvc.exe (PID: 3908)
      • Kernelmoduleunloader.exe (PID: 5656)
      • Cheat Engine.exe (PID: 6176)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5904)
      • rsWSC.exe (PID: 3876)
      • rsWSC.exe (PID: 7080)
      • rsClientSvc.exe (PID: 7040)
      • rsClientSvc.exe (PID: 6908)
      • rsEngineSvc.exe (PID: 4784)
      • rsEngineSvc.exe (PID: 6420)
      • rsHelper.exe (PID: 6688)
      • rsEDRSvc.exe (PID: 6256)
      • rsEDRSvc.exe (PID: 1372)
      • rsAppUI.exe (PID: 3996)
      • rsAppUI.exe (PID: 3988)
      • rsAppUI.exe (PID: 1692)

    • Process checks computer location settings

      • 03782294.tmp (PID: 6432)
      • prod0.exe (PID: 7164)
      • 03782294.tmp (PID: 6528)
      • Cheat Engine.exe (PID: 6176)
      • rsAppUI.exe (PID: 3996)
      • rsAppUI.exe (PID: 1784)
      • rsAppUI.exe (PID: 7288)

    • Reads the software policy settings

      • 03782294.tmp (PID: 6528)
      • prod0.exe (PID: 7164)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5904)
      • rsWSC.exe (PID: 3876)
      • UnifiedStub-installer.exe (PID: 4576)
      • rsEngineSvc.exe (PID: 4784)
      • rsWSC.exe (PID: 7080)
      • rsEngineSvc.exe (PID: 6420)
      • rsEDRSvc.exe (PID: 6256)
      • rsEDRSvc.exe (PID: 1372)

    • Reads the machine GUID from the registry

      • 03782294.tmp (PID: 6528)
      • prod0.exe (PID: 7164)
      • UnifiedStub-installer.exe (PID: 4576)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5904)
      • rsWSC.exe (PID: 3876)
      • rsWSC.exe (PID: 7080)
      • rsEngineSvc.exe (PID: 4784)
      • rsEngineSvc.exe (PID: 6420)
      • rsHelper.exe (PID: 6688)
      • rsEDRSvc.exe (PID: 6256)
      • rsEDRSvc.exe (PID: 1372)
      • rsAppUI.exe (PID: 3996)

    • Disables trace logs

      • prod0.exe (PID: 7164)
      • UnifiedStub-installer.exe (PID: 4576)
      • rsEngineSvc.exe (PID: 6420)
      • rsEDRSvc.exe (PID: 1372)

    • Checks proxy server information

      • prod0.exe (PID: 7164)
      • 03782294.tmp (PID: 6528)
      • UnifiedStub-installer.exe (PID: 4576)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5904)
      • rsWSC.exe (PID: 3876)
      • rsAppUI.exe (PID: 3996)

    • Reads Environment values

      • prod0.exe (PID: 7164)
      • UnifiedStub-installer.exe (PID: 4576)
      • rsEngineSvc.exe (PID: 6420)
      • rsEDRSvc.exe (PID: 1372)
      • rsAppUI.exe (PID: 3996)

    • Creates files in the program directory

      • CheatEngine75.tmp (PID: 2632)
      • UnifiedStub-installer.exe (PID: 4576)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5904)
      • rsWSC.exe (PID: 3876)
      • rsEngineSvc.exe (PID: 4784)
      • rsEngineSvc.exe (PID: 6420)
      • rsEDRSvc.exe (PID: 6256)
      • rsEDRSvc.exe (PID: 1372)

    • Creates a software uninstall entry

      • CheatEngine75.tmp (PID: 2632)

    • Creates files or folders in the user directory

      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 5904)
      • UnifiedStub-installer.exe (PID: 4576)
      • rsWSC.exe (PID: 3876)
      • rsEngineSvc.exe (PID: 6420)
      • rsAppUI.exe (PID: 3996)
      • rsAppUI.exe (PID: 1692)

    • .NET Reactor protector has been detected

      • UnifiedStub-installer.exe (PID: 4576)
      • rsWSC.exe (PID: 7080)
      • rsEngineSvc.exe (PID: 6420)

    • Reads the time zone

      • runonce.exe (PID: 3540)
      • rsEngineSvc.exe (PID: 6420)
      • rsEDRSvc.exe (PID: 1372)

    • Reads security settings of Internet Explorer

      • runonce.exe (PID: 3540)

    • Reads CPU info

      • rsEngineSvc.exe (PID: 6420)
      • rsEDRSvc.exe (PID: 1372)

    • Reads product name

      • rsEDRSvc.exe (PID: 1372)
      • rsEngineSvc.exe (PID: 6420)
      • rsAppUI.exe (PID: 3996)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (51.8)
.exe | InstallShield setup (20.3)
.exe | Win32 EXE PECompact compressed (generic) (19.6)
.dll | Win32 Dynamic Link Library (generic) (3.1)
.exe | Win32 Executable (generic) (2.1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:11:15 09:48:30+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 741376
InitializedDataSize: 38400
UninitializedDataSize: -
EntryPoint: 0xb5eec
OSVersion: 6.1
ImageVersion: 6
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 7.5.0.0
ProductVersionNumber: 7.5.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription: EngineGame Installer
FileVersion: 7.5.0
LegalCopyright: © EngineGame
OriginalFileName:
ProductName: EngineGame
ProductVersion: 7.5.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
194
Monitored processes
60
Malicious processes
12
Suspicious processes
2

Behavior graph

Click at the process to see the details
start 03782294.exe 03782294.tmp no specs 03782294.exe 03782294.tmp prod0.exe cheatengine75.exe cheatengine75.tmp net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs _setup64.tmp no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs 4rxjtkoi.exe THREAT unifiedstub-installer.exe rssyncsvc.exe no specs conhost.exe no specs rssyncsvc.exe no specs kernelmoduleunloader.exe windowsrepair.exe no specs icacls.exe no specs conhost.exe no specs cheat engine.exe no specs THREAT cheatengine-x86_64-sse4-avx2.exe rundll32.exe runonce.exe no specs grpconv.exe no specs wevtutil.exe no specs conhost.exe no specs fltmc.exe no specs conhost.exe no specs wevtutil.exe no specs conhost.exe no specs rswsc.exe THREAT rswsc.exe no specs rsclientsvc.exe no specs conhost.exe no specs rsclientsvc.exe no specs rsenginesvc.exe no specs THREAT rsenginesvc.exe rsedrsvc.exe no specs rshelper.exe no specs rsedrsvc.exe epp.exe no specs rsappui.exe no specs wmiapsrv.exe no specs rsappui.exe no specs rsappui.exe no specs rsappui.exe no specs rslitmus.a.exe no specs conhost.exe no specs rsappui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1060\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—icacls.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1128\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—fltMC.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1128"c:\program files\reasonlabs\EPP\ui\EPP.exe" --minimized --first-runC:\Program Files\ReasonLabs\EPP\ui\EPP.exe—rsEngineSvc.exe
User:
admin
Company:
Reason Cybersecurity Ltd.
Integrity Level:
MEDIUM
Description:
RAV Endpoint Protection Client
Exit code:
0
Version:
5.33.1
Modules
Images
c:\program files\reasonlabs\epp\ui\epp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
1372"C:\Program Files\ReasonLabs\EDR\rsEDRSvc.exe"C:\Program Files\ReasonLabs\EDR\rsEDRSvc.exe
services.exe
User:
SYSTEM
Company:
Reason Cybersecurity Ltd.
Integrity Level:
SYSTEM
Description:
Reason EDR Service
Version:
2.2.0
Modules
Images
c:\program files\reasonlabs\edr\rsedrsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1432"C:\Program Files\Cheat Engine 7.5\windowsrepair.exe" /sC:\Program Files\Cheat Engine 7.5\windowsrepair.exe—CheatEngine75.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\cheat engine 7.5\windowsrepair.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
1692"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\admin\AppData\Roaming\ReasonLabs\EPP" --standard-schemes=mc --secure-schemes=mc --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=2044 --field-trial-handle=1784,i,252440182276357321,15075389706877388042,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe—rsAppUI.exe
User:
admin
Company:
Reason Cybersecurity Ltd.
Integrity Level:
MEDIUM
Description:
ReasonLabs Application
Version:
1.4.2
Modules
Images
c:\program files\reasonlabs\common\client\v1.4.2\rsappui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
1748\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1784"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Roaming\ReasonLabs\EPP" --standard-schemes=mc --secure-schemes=mc --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-user-model-id=com.reasonlabs.epp --app-path="C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2328 --field-trial-handle=1784,i,252440182276357321,15075389706877388042,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe—rsAppUI.exe
User:
admin
Company:
Reason Cybersecurity Ltd.
Integrity Level:
LOW
Description:
ReasonLabs Application
Version:
1.4.2
Modules
Images
c:\program files\reasonlabs\common\client\v1.4.2\rsappui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
2224"sc" delete BadlionAnticheatC:\Windows\System32\sc.exe—CheatEngine75.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
2632"C:\Users\admin\AppData\Local\Temp\is-GT7OJ.tmp\CheatEngine75.tmp" /SL5="$501DE,26511452,832512,C:\Users\admin\AppData\Local\Temp\is-VPB81.tmp\CheatEngine75.exe" /VERYSILENT /ZBDISTC:\Users\admin\AppData\Local\Temp\is-GT7OJ.tmp\CheatEngine75.tmp
CheatEngine75.exe
User:
admin
Company:
Cheat Engine
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-gt7oj.tmp\cheatengine75.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
Total events
60 313
Read events
59 951
Write events
283
Delete events
79

Modification events

(PID) Process:(6528) 03782294.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
80190000977BA3B9DEE5DA01
(PID) Process:(6528) 03782294.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
5F954FCE33972D632B267FA2DB2147C995FFC1BA38065BB8D40DEF8B954DE7E6
(PID) Process:(6528) 03782294.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(6528) 03782294.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6528) 03782294.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6528) 03782294.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6528) 03782294.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(7164) prod0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\prod0_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7164) prod0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\prod0_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7164) prod0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\prod0_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
664
Suspicious files
225
Text files
470
Unknown types
25

Dropped files

PID
Process
Filename
Type
2632CheatEngine75.tmpC:\Program Files\Cheat Engine 7.5\is-F9E3B.tmpexecutable
MD5:9AA2ACD4C96F8BA03BB6C3EA806D806F
SHA256:1B81562FDAEAA1BC22CBAA15C92BAB90A12080519916CFA30C843796021153BB
652803782294.tmpC:\Users\admin\AppData\Local\Temp\is-VPB81.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
641203782294.exeC:\Users\admin\AppData\Local\Temp\is-SF9EC.tmp\03782294.tmpexecutable
MD5:1CDBF6DA4DEFE32C9CB5908968A02FAB
SHA256:87C1BB2236A874C97369B2CCA0D55559FA917707CEBDDF7A5EABC691F8302487
652803782294.tmpC:\Users\admin\AppData\Local\Temp\is-VPB81.tmp\prod0executable
MD5:6A925375674EF35E5DB24CBC72D4F64B
SHA256:405676C1F44B68AD672A3BF3EF28C879372A4EBF8515FAF750CC49D9E0D9D7D0
652803782294.tmpC:\Users\admin\AppData\Local\Temp\is-VPB81.tmp\CheatEngine75.exeexecutable
MD5:E0F666FE4FF537FB8587CCD215E41E5F
SHA256:F88B0E5A32A395AB9996452D461820679E55C19952EFFE991DEE8FEDEA1968AF
652803782294.tmpC:\Users\admin\AppData\Local\Temp\is-VPB81.tmp\is-CG7VR.tmpexecutable
MD5:6A925375674EF35E5DB24CBC72D4F64B
SHA256:405676C1F44B68AD672A3BF3EF28C879372A4EBF8515FAF750CC49D9E0D9D7D0
652803782294.tmpC:\Users\admin\AppData\Local\Temp\is-VPB81.tmp\is-MFPP3.tmpimage
MD5:CD09F361286D1AD2622BA8A57B7613BD
SHA256:B92A31D4853D1B2C4E5B9D9624F40B439856D0C6A517E100978CBDE8D3C47DC8
652803782294.tmpC:\Users\admin\AppData\Local\Temp\is-VPB81.tmp\zbShieldUtils.dllexecutable
MD5:FAD0877741DA31AB87913EF1F1F2EB1A
SHA256:73FF938887449779E7A9D51100D7BE2195198A5E2C4C7DE5F93CEAC7E98E3E02
2632CheatEngine75.tmpC:\Users\admin\AppData\Local\Temp\is-G2O26.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
2632CheatEngine75.tmpC:\Program Files\Cheat Engine 7.5\unins000.exeexecutable
MD5:9AA2ACD4C96F8BA03BB6C3EA806D806F
SHA256:1B81562FDAEAA1BC22CBAA15C92BAB90A12080519916CFA30C843796021153BB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
32
TCP/UDP connections
90
DNS requests
37
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2876
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6908
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6852
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
2876
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5904
cheatengine-x86_64-SSE4-AVX2.exe
GET
200
172.217.18.99:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
—
—
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBTh4QXD3xfHaxna9yfH20h%2Ft5LfbQQUZZ9RzoVofy%2BKRYiq3acxux4NAF4CEzMAAJV0yDQshyPtjUMAAAAAlXQ%3D
unknown
—
—
whitelisted
—
—
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBTDHsfuqfubd3pihvq4mgQVWgHWNwQUyH7SaoUqG8oZmAQHJ89QEE9oqKICEzMAAAAHh6M0o3uljhwAAAAAAAc%3D
unknown
—
—
whitelisted
4576
UnifiedStub-installer.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Public%20RSA%20Timestamping%20CA%202020.crl
unknown
—
—
whitelisted
—
—
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBTOQYLFSE5GO%2FpaRVfYu7d9gZEbQAQU2UEpsA8PY2zvadf1zSmepEhqMOYCEzMAAAAF%2B3pcMhNh310AAAAAAAU%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4088
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4080
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4088
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6528
03782294.tmp
18.66.137.45:443
d2oq4dwfbh6gxl.cloudfront.net
AMAZON-02
US
unknown
5336
SearchApp.exe
184.86.251.11:443
www.bing.com
Akamai International B.V.
DE
unknown
5336
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
  • 40.127.240.158
whitelisted
google.com
  • 142.250.186.78
whitelisted
d2oq4dwfbh6gxl.cloudfront.net
  • 18.66.137.45
  • 18.66.137.70
  • 18.66.137.114
  • 18.66.137.198
whitelisted
www.bing.com
  • 184.86.251.11
  • 184.86.251.22
  • 184.86.251.17
  • 184.86.251.19
  • 184.86.251.14
  • 184.86.251.15
  • 184.86.251.20
  • 184.86.251.16
  • 184.86.251.24
  • 184.86.251.25
  • 184.86.251.13
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.31.67
  • 40.126.31.73
  • 20.190.159.2
  • 40.126.31.71
  • 20.190.159.73
  • 40.126.31.69
  • 20.190.159.64
  • 20.190.159.75
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
th.bing.com
  • 184.86.251.7
  • 184.86.251.11
  • 184.86.251.8
  • 184.86.251.31
  • 184.86.251.9
  • 184.86.251.30
  • 184.86.251.28
  • 184.86.251.10
  • 184.86.251.4
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted
arc.msn.com
  • 20.74.47.205
whitelisted

Threats

No threats detected
Process
Message
Kernelmoduleunloader.exe
Kernelmodule unloader
Kernelmoduleunloader.exe
Running in wow64
Kernelmoduleunloader.exe
Setup. So do not show messages
Kernelmoduleunloader.exe
attempting to unload
Kernelmoduleunloader.exe
SCManager opened
Kernelmoduleunloader.exe
count=0
Kernelmoduleunloader.exe
setup=true
cheatengine-x86_64-SSE4-AVX2.exe
Lua thread terminated
rsEngineSvc.exe
Native library pre-loader is trying to load native SQLite library "C:\Program Files\ReasonLabs\EPP\x64\SQLite.Interop.dll"...
rsEDRSvc.exe
Native library pre-loader is trying to load native SQLite library "C:\Program Files\ReasonLabs\EDR\x64\SQLite.Interop.dll"...
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
03782294